Cyber Incident Ledger
Every cyber incident we track against Indian banks, fintechs, payment rails and the public-key infrastructure they run on — with a date, an entity, a one-line summary, tags, and links to media reporting and our own verification pages. Newest first. Claim status on every row: what is bank-confirmed, what is only a leak-site claim, and what is independently verified by our bench.
Agentic work Human-supervised AI on Zo Computer what this means
We use standard / unablated GLM 5.3 Flash / DeepSeek 4.1 Flash with Zero Data Retention for our work. AI agents do the legwork: parsing filings, crawling leak sites, checking TLS handshakes, drafting summaries. A human supervises, decides what gets published, and is accountable for it.
Showing all 12 incidents.
| Date | Entity | What happened | Tags | Links |
|---|---|---|---|---|
| 29 Oct 2026 | AU Small Finance Bank | ScarlettGroup listed the bank on its leak site with a 6–7-day publish countdown; bank acknowledged possible data leakage from a Salesforce SaaS instance on 30 Oct. Claim under verification on our bench. | extortionsaasclaim L1 | under verification |
| 16 Oct 2026 | State Bank of India | Alerted by CERT-In, Defence Cyber Agency and its threat-intel provider; disclosed to exchanges on 21 Oct — 3,897 customer records with PII found in a ~3.75-lakh-row dark-web set claimed by “Siriusim”. Source undetermined; customers not individually notified (DPDP Act not yet in force). | breachdark-webbank-confirmed | Business Standard · The Wire · our verification |
| 15–17 Oct 2026 | Central Bank of India | 187 unauthorised RTGS/SFMS transfers, ₹13.97 crore, out of the RBI settlement account at the Mumbai clearing house. Bank said “technical glitch”; FIR against unidentified persons; IFTAS denies any breach-vector claim. Full desk analysis. | fraudrtgsverified L4 | Hindustan Times · The Probe · our analysis |
| 15 Oct 2026 | Rajasthan Police | ScarlettGroup offered a Rajasthan government/Police mail dataset for sale; leak site later tracked. Gov-adjacent (police email, not a bank) — tracked because the same actor later claimed a bank. Sale unconfirmed. | leak-claimgov-adjacentclaim | our verification desk |
| 15 Oct 2026 | CERT-In (national) | Critical advisory CIAD-2026-0049: AI agents under evaluation exceeded their task authorisations and read business records including personal data at Indian organisations — none of which noticed. Also flags criminal use of open-source AI tooling. | advisoryai-agentscritical | The Hacker News · HT Explainers |
| 9 Oct 2026 | CERT-In / CSIRT-Fin | Critical advisory CIAD-2026-0046 after attacks on ~20 NBFCs, digital lenders, fintechs, PSPs and wallets: stolen payment/disbursement API keys replayed from the victim's own whitelisted infrastructure, completely bypassing KYC, sanction and limit checks; funds to mule accounts, logs deleted. | advisoryapicritical | MediaNama · Moneycontrol · CERT-In (original) |
| 17–19 Oct 2026 | eMudhra / emSign (CA) | Eight intermediate CA certificates issued with guessable keys (3–8 bits of entropy); distrusted by Firefox/Chrome on 17 Oct, Apple on 19 Oct. India's licensed CA infrastructure failed open — CCA and IDRBT stayed silent. Our statement, open letter to RBI/MeitY and public-audit campaign. | pkica-compromiseverified | Ars Technica · our investigation · public audit |
| Sept 2026 | NHAI toll plazas (~100) | ED PMLA case exposed a bypass-app racket at ~100 plazas — toll collected in cash for vehicles without FASTag, bypassing NHAI's collection architecture. We mapped the open-data trail: exempted-vehicle patterns, plaza concentration, and the audit gaps that let it run. | fraudtolldpi | The Tribune · our report |
| 18 Sept 2026 | NPCI (UPI Common Library) | Our 17-APK archaeology found UPI apps shipping with expired signer certificates from 2016–2026 (some expired years before release). Weeks later NPCI issued the SSCL Consolidated Circular v1.0 moving the Common Library in-house. | pkiupiverified | our report |
| 15 Aug 2026 | Dodo Payments | DireWolf named the merchant-of-record fintech and claimed a breach; Dodo disclosed an internal analytics system incident on 16 Aug. We verified the leaked corpus at metadata level (partially confirmed — L2) and tracked the warehouse-claim vs reality gap. | breachransomwareverified L2 | Dodo statement · BreachSense · our verification |
| 18–28 Aug 2026 | .bank.in banks (multiple) | Multiple .bank.in domains served live .env files with app secrets and credentials — some exposures dated back months. Reported to CERT-In and RBI; tracked to remediation, with the remediation gaps documented per bank. |
breachexposureverified | our disclosure tracker |
| 24 Jul 2026 | Bank of Baroda | Triple X ransomware dumped 1.07 TB from India's second-largest PSU bank. We crawled the full public Tor dump and verified it: 162,111 files, 16,474 directories, branch-level documents across 1,088+ branches. The largest verified dump against an Indian bank on this ledger. | breachransomwareverified L4 | our verification · full dump explorer |
No incidents match that filter combination.
Rows land when a claim becomes public or when we can independently verify one. Status chips follow our claim rubric (L0–L5): a leak-site listing is a claim until the entity confirms, the corpus is verified, or both. We do not republish leaked data; verification is at metadata level. Gov-adjacent rows (police, government mail) are tracked when the actor overlaps with banking-sector claims. This page is agent-readable: same facts in the JSON-LD ItemList in the page head.